Granted Patent B1

US 11,089,064 · App. 15/341,463 · Granted Aug 10, 2021

Inventors: Sekhar Sarukkai (Cupertino, CA); Prasad Raghavendra Somasamudram (Bangalore, IN); Rama Taraniganty (Cupertino, CA); Vikram Jaiswal (Fremont, CA); Chapman Seto (San Jose, CA); Ravi Hingarajiya (Sunnyvale, CA); Surendrakumar Viswanathan (Santa Clara, CA); Kaushik Narayan (San Jose, CA); Pradeep Kumar Reddy Mangalapuri (Bangalore, IN); Guruprasad Shenoy (Bangalore, IN)

Assignee: Skyhigh Networks, LLC

H04L63/205H04L43/0876H04L63/0281H04L63/1408

Abstract

Claims (66)

1. A method of implementing cloud security policy enforcement for web applications being used by an enterprise, the method comprising:

monitoring network traffic to and from the enterprise using a hardware processor;

detecting and identifying a plurality of cloud activities relating to a web application using the hardware processor, wherein each of the plurality of cloud activities is an action being taken by the web application, wherein identifying each of the plurality of cloud activities includes identifying the type of action being performed by the cloud activity, and wherein at least one of the plurality of cloud activities is identified based on both a request and a response payload in the network traffic;

filtering the plurality of cloud activities to identify security-related application activities relating to the web application;

classifying the security-related application activities relating to the web application into at least a first group of application activities, a second group of application activities, and a third group of application activities, wherein a first portion of the security-related application activities are classified into the first group of application activities, wherein being classified into the first group indicates that the first group of application activities are each to be mapped to one of a first plurality of activity categories, wherein a second portion of the security-related application activities are classified into the second group of application activities, wherein being classified into the second group indicates that second group of application activities are each to be ignored, wherein a third portion of the security-related application activities are classified into the third group of application activities, wherein being classified into the third group indicates that the third group of application activities cannot be mapped to any of the plurality of activity categories, and wherein each of the first portion of the security-related application activities, the second portion of security-related application activities, and the third portion of the security-related application activities are different;

ignoring the second portion of the security-related application activities classified into the second group;

generating an alert in response to an application activity being classified into the third group, wherein the alert indicates that the application activity should be reviewed and that the plurality of activity categories may need to be updated to include the application activity; and

for each application activity of the first portion of the security-related application activities relating to the web application:

mapping the application activity to one of the plurality of activity categories based on a signature of the application activity, wherein each of the plurality of activity categories is associated with a corresponding set of one or more security enforcement policies and wherein the plurality of activity categories describe at least one of a data operation and an account operation;

associating the corresponding set of one or more security enforcement policies of the mapped activity category to the application activity; and

applying the corresponding set of one or more security enforcement policies to network traffic corresponding to the application activity based on the application activity being mapped to the mapped activity category.

2. The method of claim 1 , further comprising for each application activity of the first portion of the security-related application activities:

generating a metadata bundle containing information indicative of the application activity, the web application, and the one of the plurality of activity categories; and

generating the corresponding set one or more of security enforcement policies for the application activity using the metadata bundle.

3. The method of claim 1 , wherein the hardware processor implements a network proxy server to monitor network traffic to and from the enterprise.

4. The method of claim 1 , wherein the hardware processor implements an infrastructure security module at a cloud service provider hosting the web application to monitor network traffic to and from the enterprise.

5. The method of claim 1 , wherein the hardware processor implements a containerized cloud security reverse proxy embedded in a containerized web application to monitor network traffic to and from the enterprise, the containerized web application being configured in an application container.

6. The method of claim 5 , further comprising:

embedding the containerized cloud security reverse proxy into the application container containing the containerized web application by accessing an application programming interface (API) of the application container to generate a reverse proxy configuration.

7. The method of claim 1 , wherein the set of one or more security enforcement policies includes security policies for threat detection, data encryption, data loss prevention, and access control.

8. The method of claim 1 , wherein a first application activity of the first portion of the security-related application activities is mapped to a first activity category, further comprising:

tagging at least one data field in the first application activity; and

associating a first security enforcement policy of the first activity category to the first application activity, the first security enforcement policy comprising encrypting data in the tagged data fields associated with the first application activity.

9. A system for implementing cloud security policy enforcement for web applications being used by an enterprise, the system comprising:

a processor; and

a memory coupled with the processor, wherein the memory is configured to provide the processor with instructions which when executed cause the processor to:

monitor network traffic to and from the enterprise;

detect and identify a plurality of cloud activities relating to a web application, wherein each of the plurality of cloud activities is an action being taken by the web application, wherein identifying each of the plurality of cloud activities includes identifying the type of action being performed by the cloud activity, and wherein at least one of the plurality of cloud activities is identified based on both a request and a response payload in the network traffic;

filter the plurality of cloud activities to identify security-related application activities relating to the web application;

classify the security-related application activities relating to the web application into at least a first group of application activities, a second group of application activities, and a third group of application activities, wherein a first portion of the security-related application activities are classified into the first group of application activities, wherein being classified into the first group indicates that the first group of application activities are each to be mapped to one of a first plurality of activity categories, wherein a second portion of the security-related application activities are classified into the second group of application activities, wherein being classified into the second group indicates that second group of application activities are each to be ignored, wherein a third portion of the security-related application activities are classified into the third group of application activities, wherein being classified into the third group indicates that the third group of application activities cannot be mapped to any of the plurality of activity categories, and wherein each of the first portion of the security-related application activities, the second portion of security-related application activities, and the third portion of the security-related application activities are different;

ignore the second portion of the security-related application activities classified into the second group;

generate an alert in response to an application activity being classified into the third group, wherein the alert indicates that the application activity should be reviewed and that the plurality of activity categories may need to be updated to include the application activity; and

for each application activity of the first portion of the security-related application activities relating to the web application:

map the application activity to one of the plurality of activity categories based on a signature of the application activity, wherein each of the plurality of activity categories is associated with a corresponding set of one or more security enforcement policies and wherein the plurality of activity categories describe at least one of a data operation and an account operation;

associate the corresponding set of one or more security enforcement policies of the mapped activity category to the application activity; and

apply the corresponding set of one or more security enforcement policies to network traffic corresponding to the application activity based on the application activity being mapped to the mapped activity category.

10. The system recited in claim 9 , wherein the memory is further configured to provide the processor with instructions which when executed cause the processor to, for each application activity of the first portion of the security-related application activities:

generate a metadata bundle containing information indicative of the application activity, the web application, and the one of the plurality of activity categories; and

generate the corresponding set of one or more security enforcement policies for the application activity using the metadata bundle.

11. The system recited in claim 9 , wherein the memory is further configured to provide the processor with instructions which when executed cause the processor to:

provide a containerized cloud security reverse proxy embedded in a containerized web application to monitor network traffic to and from the enterprise, the containerized web application being configured in an application container.

12. The system recited in claim 9 , wherein the set of one or more security enforcement policies includes security policies for threat detection, data encryption, data loss prevention, and access control.

13. The system recited in claim 9 , wherein a first application activity of the first portion of the security-related application activities is mapped to a first activity category, and wherein the memory is further configured to provide the processor with instructions which when executed cause the processor to:

tag at least one data field in the first application activity; and

associate a first security enforcement policy of the first activity category to the first application activity, the first security enforcement policy comprising encrypting data in the tagged data fields associated with the first application activity.

14. A non-transitory computer-readable medium containing computer executable instructions that, when executed by a processor, cause the processor to perform a method for implementing cloud security policy enforcement for web applications being used by an enterprise, the method comprising:

monitoring network traffic to and from the enterprise using a hardware processor;

detecting and identifying a plurality of cloud activities relating to a web application using the hardware processor, wherein each of the plurality of cloud activities is an action being taken by the web application, wherein identifying each of the plurality of cloud activities includes identifying the type of action being performed by the cloud activity, and wherein at least one of the plurality of cloud activities is identified based on both a request and a response payload in the network traffic;

filtering the plurality of cloud activities to identify security-related application activities relating to the web application;

classifying the security-related application activities relating to the web application into at least a first group of application activities, a second group of application activities, and a third group of application activities, wherein a first portion of the security-related application activities are classified into the first group of application activities, wherein being classified into the first group indicates that the first group of application activities are each to be mapped to one of a first plurality of activity categories, wherein a second portion of the security-related application activities are classified into the second group of application activities, wherein being classified into the second group indicates that second group of application activities are each to be ignored, wherein a third portion of the security-related application activities are classified into the third group of application activities, wherein being classified into the third group indicates that the third group of application activities cannot be mapped to any of the plurality of activity categories, and wherein each of the first portion of the security-related application activities, the second portion of security-related application activities, and the third portion of the security-related application activities are different;

ignoring the second portion of the security-related application activities classified into the second group;

generating an alert in response to an application activity being classified into the third group, wherein the alert indicates that the application activity should be reviewed and that the plurality of activity categories may need to be updated to include the application activity; and

for each application activity of the first portion of the security-related application activities relating to the web application:

mapping the application activity to one of the plurality of activity categories based on a signature of the application activity, wherein each of the plurality of activity categories is associated with a corresponding set of one or more security enforcement policies and wherein the plurality of activity categories describe at least one of a data operation and an account operation;

associating the corresponding set of one or more security enforcement policies of the mapped activity category to the application activity; and

applying the corresponding set of one or more security enforcement policies to network traffic corresponding to the application activity based on the application activity being mapped to the mapped activity category.

15. The non-transitory computer-readable medium of claim 14 , wherein the method further comprises:

for each application activity of the first portion of the security-related application activities:

generating a metadata bundle containing information indicative of the application activity, the web application, and the one of the plurality of activity categories; and

generating the corresponding set of one or more security enforcement policies for the application activity using the metadata bundle.

16. The non-transitory computer-readable medium of claim 14 , wherein the method further comprises:

providing a containerized cloud security reverse proxy embedded in a containerized web application to monitor network traffic to and from the enterprise, the containerized web application being configured in an application container.

17. The non-transitory computer-readable medium of claim 14 , wherein the set of one or more security enforcement policies includes security policies for threat detection, data encryption, data loss prevention, and access control.

18. The non-transitory computer-readable medium of claim 14 , wherein a first application activity of the first portion of the security-related application activities is mapped to a first activity category, and wherein the method further comprises:

tagging at least one data field in the first application activity; and

associating a first security enforcement policy of the first activity category to the first application activity, the first security enforcement policy comprising encrypting data in the tagged data fields associated with the first application activity.

Assignments (16)

Continuity (1)

Cited By (7)

US 12,197,968 US 12,204,650 US 12,244,560 US 12,267,355 US 12,284,206 US 12,299,117 US 12,682,341